| thought it could be useful to share my experience installing Ubuntu Linux on my rooted TV thanks to 
SamyGo. With some help it could become a very good set up for our TV's ^^. 


What is this? 

This is a project to install a "full" Ubuntu Linux system that natively runs on your rooted Samsung Smart 
TV. But since | don't want to get anyone's hopes up, note that the current state of the project has some 
major drawbacks that makes it difficult to use, namely a very low performance so it might not worth it 
for you. 


What do | need? 

e ASamsung Smart TV (LOL). I'll be using my 46ES8000. 

e Root access + telnet + ftp. You can get this using SamyGo... or creating your own hook in 
libSkype.so to get them (jk, don't waste your time like that :P). 

e A second computer with telnet and ftp clients. I'll be using my Windows laptop, with PuTTY and 
winSPC. Since it's a laptop | can work right in front of the TV. 

e An USB storage device (HDD, pendrive, etc...) with at least 2 GB. | would recommend a 4 GB one. 
I'll be using a Kingston Datatravel 3.0 with 64 GB. 


Things to consider... 
| didn't want this to be a risky project that could potentially kill my TV, that's why we won't be touching 
the TV's internal memory. This makes the project harder, but at least we are 10096 safe ©. 


Also, note that | haven't been able to test all this in a different TV, | guess it should work the same (or 
even better in newer models), but | can't confirm it. 


So let's a-gol 
We are going to download Ubuntu Linux into our pendrive and configure a chroot environment that will 
use the tv's XServer (yes, the SmatHub runs in an XServer) to display our X11 desktop. 


First, plug your pendrive in one of the TV's USB port. Then, it's time to format it. We are gonna use XFS, 
since it's the only fully supported Linux filesystem my TV's kernel support (and since I want this a safe 
procedure, | wouldn't like to flash a new kernel xD). 


- You can check the pendrive linux device with: 
o VDLinux#> df —h 
o (in my case it was /dev/sda1) 

- Then unmount it: 
o VDLinux#> umount /dev/sda1 

- Format the device, I’m using the -f option cos | already had a filesystem there: 
o VDLinux#> mkfs.xfs /dev/sda1 -f 

- Mount it where you want your Ubuntu installation. I’m gonna use /mnt/core: 
o VDLinux#> mkdir /mnt/core/ 
o VDLinux#> mount /dev/sda1/ /mnt/core 


Awesome, we have our storage media set up, now it's time to download a Linux filesystem. Any one 
should do it, but | used Ubuntu Core for convenience. Since my TV is an ARM device with no hard float 
support, I’m gonna use the last armel release available, which is Ubuntu 12.4 Precise Pangoling. You can 
get it from here: 


http://old-releases.ubuntu.com/releases/ubuntu-core/releases/12.04/release/ubuntu-core-12.04-core- 





armel.tar.gz 


Now send the downloaded archive to our pendrive using the ftp client: 


- Log anonymously in the TV's ftp server: 


Session 
File protocol: 


Host name: Port number: 
132.163.0.3 21 = 


User name: Password: 


anonymous SPREE E EEE 


save — [v 





- Goto /mnt/core and drop the tar archive there: 








/mnt/core 
| Name Ext z . | Changed Rights 
= ubuntu-core-12.04-core-ar.. . 1/1/2014 12:42 AM rw-r--r-- 


- Let's decompress the filesystem archive, then we can delete it: 
o VDLinux#> cd /mnt/core 
o VDLinux#> tar —xzvf ubuntu-core-12.04-core-armel.tar.gz 
o VDLinux#> rm ubuntu-core-12.04-core-armel.tar.gz 


The result is a full Linux fileystem in our pendrive! Now it's time to set it up. 


Usually, when configuring a chroot environment, one would use the mount —bind to share some 
resources between the host filesystem (in our case provided by SamyGo) and the guest filesystem (the 
one we just decompressed). 


However, the —bind option simply does not work in my TV, | don't know why but since the binaries seem 
to be OK, I can only think the binding feature is missing at kernel level (and we don't want to flash a new 
kernel so...), we can get around this simply copy the needed resources from the host filesystem. That's 
what we're gonna do to get network support under Ubuntu: 


e To get network support: 
o VDLinux#> cp /etc/resolv.conf /mnt/core/etc/resolv.conf 
o VDLinux#> cp /etc/hosts /mnt/core/etc/hosts 
o VDLinux#> cp /etc/HOSTNAME /mnt/core/etc/hostname 


At this point we can enter Ubuntu typing: 
o VDLinux#> chroot /mnt/core /bin/bash 

Welcome to Ubuntu! One interesting thing to avoid future errors is to set the host name: 
o root@(none):/# hostname localhost 


Note that the hostname won't be update until the next time you log in, for the time being it'll stay as 
(none), but that's fine ©. 


To get more features in the Ubuntu chrooted environment, let's mount some virtual filesystems: these 
are shared with the host filesystem: 


root@(none):/# mount -t sysfs sysfs /sys 
root@(none):/# mount -t proc proc /proc 
root@(none):/# mount -t usbfs none /proc/bus/usb 
root@(none):/# mount -t devpts devpts /dev/pts 


O O O O9 


Just like that, let's set some environment variables we're gonna need: 


export LD. LIBRARY. PATH-"" 

export HOME="/root" 

export TMPDIR="/tmp" 

export FONTCONFIG_FILE="/etc/fonts/fonts.conf" 

export FONTCONFIG PATH-"/etc/fonts" 

export PANGO RC FILE-z"/usr/lib/arm-linux-gnueabi/pango/pangorc" 


O O O O O 00) 


Since we don’t have bind support, we cannot have the host /dev directoy, but just like we did with those 
network configuration files, we can reproduce device nodes in our chroot. 


I’m just gonna create the framebuffer for now, but note that in the future, to get support for all the TV 
devices, we should create all device nodes present in the original /dev directory. For this, we are gonna 
need major and minor device numbers, the following link may help you: 


https://www.kernel.org/doc/Documentation/devices.txt 
In general, you can just check these straight from the original /dev using: 
o VDLinux#> Is -Rla /dev 


Even though we could create a script to make all those node automatically, the framebuffer is enough 
for now: 


o root@(none):/# mknod /dev/fbo c 29 0 
Another interesting one could be the mouse (we're not gonna use it for now, though): 


o root@(none):/# mkdir /dev/input 
o root@(none):/# mknod /dev/input/mice c 13 63 


The TV's framebuffer Is pretty interesting: by default, it's a 32 bit colorbuffer that uses the alpha channel 
not only for opacity, but also as a flag to show the TV picture. This is what the TV uses for PIP. We could 
exploit this to capture TV screens, or record video straight from the telnet session, as well as injecting 
images in our TV. But, as | said, it's better if we leave that to the XServer. 


Let's continue with the Ubuntu set up. It's now time to install some new software! By default, Ubuntu 
Core includes just a few package repositories. Since those may not be enough, we can go and edit the 
file /etc/apt/sources.list to add some extra repositories. To make things faster, | use WinSCP for this. 
My sources.list files looks like this after edition: 
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deb http: orts.ubuntu.com/ubuntu-ports/ precise main universe multiverse restricted 
4 deb http: orts.ubuntu.com/ubuntu-ports/ precise-security main restricted 


| Name Ext © .. Changed Rights 


5 deb http: orts.ubuntu.com/ubuntu-ports/ precise-updates main restricted 5 
d apt.conf.d 1/1/1970 TWXI-XI-X 
di preferences.d 4/20/2012 TWXI-XI-X 
d sources.list.d 4/20/2012 TWXT-XT-X 
}) trusted.gpg.d 4/20/2012 TWXI-XI-X 
|_| sources.list . 1/1/2014 12:08 AM TW-I--r-- 
|_| trustdb.gpg » 4/23/2012 tw------- 
|_| trusted.gpg . 1/1/1970 TW-T--T-- 
| jtrusted.gpg- . 4/23/2012 TW-I--r-- 








Make sure you save the changes. Now we can update our package lists in Ubuntu, this will also work as 
an internet access test :P: 


o root@(none):/# apt-get update 


Now we can install some interesting package, the coolest one will be the desktop itself, but let's go step 
by step. 


With this two lines you'll avoid future upstart-related errors: 


o dpkg-divert --local --rename --add /sbin/initctl 
o In-s/bin/true /sbin/initctl 


Let's install two supporting packages: 
o root@(none):/# apt-get install dialog apt-utils 
Let's install some desktop-related packages, this will take some time: 


o root@(none):/# apt-get install vim.tiny sudo ssh net-tools ethtool wireless-tools 
network-manager iputils-ping rsyslog alsa-utils 


Finally, it's time to install our desktop environment, here you can choose between a large variety and 
flavors, l've tested both the original Gnome (now Unity), and the Lightweight X11 Desktop Environment. 


| can tell Unity works better in my case so let's go for it: 
o root@(none):/# apt-get install ubuntu-desktop 2» /error.log 


The installation of the desktop may take more than an hour, it will install all gnome tools (text editor, 
graphic terminal, calculators, some game...), drivers, make some configurations, etc... This is why | 
redirect the error stream to a file, so | can check is something went wrong more easily. 


Remember to delete the error log if everything went right: 
o root@(none):/# rm /error.log 


Now that we have our desktop installed, we are gonna make a quick change so the Pango graphic library 
works alright. For this we need the original Pango modules and configuration files from the original 
filesystem. Those are present in /mtd exe/Runtime/pango: 





Ext » Changed Rights 
9/11/2013 DWXI-XT-X 
|_| pango.modules .G 9/11/2013 DWXF-XT-X 
|_| pangorc .— 9/11/2013 MWXT-XT-X 
|_| pangox.aliases .— 9/11/2013 DWXI-XF-X 


So let's copy everything in our chroot's Pango directory, which is /usr/lib/arm-linux-gnueabi/pango: 








Ext wo Changed Rights 
1/1/2014 12:15 AM PWXI-XF-X 
| |pango.modules . 1/1/1970 rw-r--r-- 
Ld pangore "m 1/1/1970 Dnw-r-r-- 


| | pangox.aliases . 1/1/1970 nW-r--r-- 


However, two of those files, pango.modules, and pangorc include references using absolute file paths 
from the original filesystem, we need to edit them so the paths match our chroot's directory structure. 
Here is how my file look after edition, you can just use the automatic replacement feature of your text 
editor :P: 


Pangorc 


j= 


= 


2 f pangorc file for uninstalled operation. 
3 # We set the path as ../modules, such that it works from any of 


ify 


# top level build subdirs. 


5 # 

6 

7 [Ranga] 

8 ModuleFiles = /usr/lib/arm-linux-gnueabi/nango/npango.modules 
3 


Pango.modules 





n Pango Modules file 


# Automatically generated file, do not edit 


t 


n A WN op 


/ugxy/1ib/arm-linus-gnueaki/pange/1.6.0/modules/pango-arabic-f¢.so ArabicScriptEngineFc PangoEngineShape PangoRenderFc arabic:* 
/usx/lib/arm-linux-gnueabi/pango/1.6.0/modules/pango-arabic-lang.so ArabicScriptEngineLang PangoEngineLang PangoRenderNone arabic:* 
6 /yusr/lib/arm-linux-gnusabi/pango/1.6.0/modules/pango-basic-f£c.so BasicScriptEngineFc PangoEngineShape PangoRenderFc armenian:* bopomofo:* cherokee:* coptic:* cyrillic:* deserst:* ethionic:* 
7  /usx/lib/arm-linux-gnusabi/pango/1.6.0/modules/pango-hangul-£c.so HangulScriptEngineFc PangoEngineShape PangoRenderFc hangyl:* 
8 /ysr/lib/arm-linux-gnueabi/pango/1.6.0/modules/pango-hebrew-£c.so HebrewScriptEngineFc PangoEngineShape PangoRenderFc hebrew:* 
E : 


/usx/lib/arm-linux-gnusabi/pango/1. 
10 /usr/lib/arm-linux-gnusabi/pango/1. 
11  /usr/lib/arm-linux-gnueabi/pango/1. 
12  /usxr/lib/arm-linux-gnusabi/pango/1. 
13  /usr/lib/arm-linux-gnusabi/pango/1. 
4 /ysx/lib/arm-linux-gnueabi/pango/1. 
15  /ysr/lib/arm-linux-gnusabi/pango/1. 


6 
6 
6 
6 
6 
6.0/modules/pango-indic-£c.so devaScriptEngineFc PangoEngineShape PangoRenderFc deyanagari:* 
6.0/modules/pango-indic-f¢.so bengScriptEngineFc PangoEngineShape PangoRenderFc bengali:* 
6.0/modules/pango-indic-£c.so guruScriptEngineFc PangoEngineShape PangoRenderFc gurmukhi:* 
6.0/modules/pango-indic-£c.so gujrScriptEngineFc PangoEngineShape PangoRenderFc guiarati:* 
6.0/modules/pango-indic-£c.so oryaScriptEngineFc PangoEngineShape PangoRenderFc goriya:* 
6.0/modules/pango-indic-£c.so tamlScriptEngineFc PangoEngineShape PangoRenderFc tamil:* 
6.0/modules/pango-indic-£c.so teluScriptEngineFc PangoEngineShape PangoRenderFc telugu:* 
16 /usxr/lib/arm-linux-gnusabi/pango/1.6.0/modules/pango-indic-£c.so kndaScriptEngineFc PangoEngineShape PangoRenderFc kannada:* 
17 J/yusxr/lib/arm-linux-gdnusabi/pango/1.6.0/modules/pango-indic-£c.so mlymScriptEngineFc PangoEngineShape PangoRenderFc malayalam:* 
8 /usr/lib/arm-linux-gnusabi/pangg/1.6.0/modules/pango-indic-£c.so sinhScriptEngineFc PangoEngineShape PangoRenderFc sinhala:* 
19  /ysr/lib/arm-linux-gdnusabi/pango/1.6.0/modules/pango-indic-lang.so devaIndicScriptEngineLang PangoEngineLang PangoRenderNone deyanagari:* 
20 /uysr/lib/arm-linux-gnusabi/pango/1.6.0/modules/pango-indic-lang.so bengIndicScriptEngineLang PangoEngineLang PangoRenderNone bengali:* 
/usx/lib/arm-linux-gnusabi/pangog/1.6.0/modules/pango-indic-lang.so guruIndicScriptEngineLang PangoEngineLang PangoRenderNone gurmukhi:* 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 
6 


/usx/lib/arm-linux-gnuseabi/pango/1.6.0/modules/pango-indic-lang.so gujriIndicScriptEngineLang PangoEngineLang PangoRenderNone gujarati:* 


/usr/lib/arm-linux-gnueabi/pango/i. 
/usr/lib/arm-linux-gnueabi/pango/1. 
/usr/lib/arm-linux-gnueabi/pango/1. 


.0/modules/pango-syriac-fc.so SyriacScriptEngineFc PangoEngineShape PangoRenderFc syriac:* 
.0/modules/pango-thai-fc.so ThaiScriptEngineFc PangoEngineShape PangoRenderFc thai:* lao:* 
.0/modules/pango-tibetan-fc.so TibetanScriptEngineFc PangoEngineShape PangoRenderFc tibetan:* 


23  /usr/lib/arm-linux-gnusabi/pango/1.6.0/modules/pango-indic-lang.so oryaIndicScriptEngineLang PangoEngineLang PangoRenderNone goriya:* 

24  /usr/lib/arm-linux-gnusabi/pango/1.6.0/modules/pango-indic-lang.so tamlIndicScriptEngineLang PangoEngineLang PangoRenderNone famil:* 

25  /gysx/lib/arm-linux-gnusabi/panggo/1.6.0/modules/pango-indic-lang.so teluIndicScriptEngineLang PangoEngineLang PangoRenderNone telugu:* 

26 /usr/lib/arm-linux-gnusabi/pango/1.6.0/modules/pango-indic-lang.so kndaIndicScriptEngineLang PangoEngineLang PangoRenderNone kannada:* 
27  /usr/lib/arm-linux-gnusabi/pango/1.6.0/modules/pango-indic-lang.so mlymIndicScriptEngineLang PangoEngineLang PangoRenderNone malayalam:* 
28  /usx/lib/arm-linux-gnusabi/pango/1.6.0/modules/pango-indic-lang.so sinhIndicScriptEngineLang PangoEngineLang PangoRenderNone sinhala:* 
29  /usr/lib/arm-linux-gnueabi/pango/1.6.0/modules/pango-khmer-fc.so KhmerScriptEngineFc PangoEngineShape PangoRenderFc khmer:* 

3 


Q 
NPB oO 


| know, | know, it says that being machine generated, we shouldn't edit it, but, we don't really have 
much choice XD. 


And that's it ladies and gentlemen, we have a basic graphic set up of Ubuntu, that will use the TV's 
XServer, we can test it by launching a graphic application from Gnome such as... Gedit! 





o Yeah, Harry potter was on TV, never mind xD. 


Now that we know we can connect to the TV's XServer, let's launch a full-fledged desktop environment. 
You can just close gedit using CTRL-C. However, running the desktop as root will give you some warnings 
(some apps will even give you errors, such as the Chromium web browser). So let's create an user: 


root (none) : / 

Adding user 

Adding new group 

Adding new user '"sky' (1001) with group 


Creating home directory "/home/sky' 
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root@ (none) :/# 


In order to not limit ourselves using the desktop environment, let’s add the new user to the sudoers: 


o root@(none):/# adduser sky sudo 


And now, let's start our graphic session: 


o root@(none):/# su sky 
o sky@localhost:/S gnome-session 


You may get a lot of warnings, errors, etc... Just ignore them and after a pair of minutes, this is what you 
should be getting in your TV: 





You can go ahead and open another telnet session, enter the chroot, set the environment variables 
again, log in your account, and start opening graphic applications that perfectly work on the XServer and 
are now integrated in the desktop, for example, the calculator: 
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Another interesting one in the SmartHub itself, now integrated in the desktop, you can simply hit the 
SmartHub button in the remote and it will show up, within an X Window named "browser": 
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Note that it is still fullscreen, but it does not fit now, since we have the Unity desktop panels, also the 
PIP frame is a little bit off-place due to those panels ^^. 


So... How do we directly interact with our new Desktop? This is no easy task, one does not simply 
connect a mouse and use it. This is because the TV's XServer does not have mouse support, instead, the 
TV mouse is hardcoded to work inside the SmartHub and its widgets, so if you connect a mouse, it will 
only work there, and ignore the input over the new desktop elements. This is regardless of 
/dev/input/mice, which actually works as expected. 


How can we get around this? Well, there are several alternatives here: 


e Configure the XServer (using the Xorg.conf present in /mtd_exe/Runtime/bin) to add mouse 
support. However, since we don't have bind mounts, and the /mtd exe partition is read-only 
we cannot edit the XServer configuration file without touching the TV's internal memory. 

e Use XdoTool: a package that allows us to use a virtual mouse (and keyboard) from the command 
line. In theory we can write a script to connect the data from /dev/input/mice to XdoTool. But 
since this takes time and I’m alone here, we'll just go with the third option. 

e Control the TV over VNC. Yay! The fastest way. The con here is that we need a computer to 
control the desktop remotely; but that's just fine for some testing ^^ 


So let's install a VNC server, l'm using sudo, since | have a session as a non-super-user: 
o sky@localhost:/S sudo apt-get install x1vnc 
To start the VNC, you need to be root so... 


o SskyQlocalhost:/S exit 
o root@localhost:/# x11vnc 


lIl be using Portable TightVNC from my windows laptop to control the desktop over VNC, we can for 
example launch Firefox and go to my blog ^^ 
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At this point all we need is to configure the rest of devices our TV has. The biggest drawback here is the 
lack of hardware graphic acceleration, making the whole environment as slow as the SmartHub (and 
even slower in many applications). In my case, this is partially due to the VNC connection, but as you can 
see in the next pic, 3D graphic applications run over the MesaGL library, which is a software rendering 
pipeline, making any game pretty much unplayable: 
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This is glmark2-es2, a 3D benchmark application that, as you can see, uses a transparent background. | 
started in from command line to see its output: | usually get between 3 and 7 frames per second :/ 


Still, we can even install emulators and use the TV as a console xD. 


o Desmume - Nintendo DS, running New Super Mario Bross (6fps) 
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o Visual boy Advance — Game Boy Advance, Running Final Fantasy Dawn Of Souls. 
Unfortunately, it's coded using a SDL surface, which the TV interprets as transparent :/ 
At least it was getting playable speeds. 
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The graphic adaptor my TV has is the Mali400 GPU, for some reason, the XServer is not configure to use 
it (maybe, just like the mouse, the Smathub is hardcoded to directly use it). Moreover, there are no Mali 
driver available for the armel architecture, you can check the rest here; 


http://linux-sunxi.org/Mali binary driver 
Some other stuff that need extra configuration to work (AKA TODO list) 


e The flash player: Currently the browser closes upon attempting to load a YouTube movie :/ 
e Sound, microphone bluetooth and camera: Maybe adding the corresponding device nodes is 
enough, but | haven't really tried. 


e SSL Certificates: You need to set the right time (since by default, it's set to the Linux Genesis xD) 
and update them. 


And that's it! If you have any question or anything, feel free to post them, or contact me over Skype (my 
username is "SkyBladeCloud"). 


"Sky 


